GDPR stands for the General Data Protection Regulation, the European Union’s comprehensive privacy law. It took effect on May 25, 2018, and changed how organizations around the world handle personal data of people in Europe. If you have ever clicked a cookie banner, received a flood of privacy-policy emails in 2018 or seen a “Do not sell or share” link, you have seen the ripple effects. This guide explains what GDPR covers, whom it protects, how it compares with US rules and what Americans can do in 2026.
1. What GDPR is
GDPR sets rules for any organization that processes personal data of individuals in the EU, regardless of where the organization is located, when it offers goods or services to those individuals or monitors their behavior. Personal data means information relating to an identifiable person, including names, emails, location data, online identifiers and more. Special categories, such as health, biometrics, race and religion, receive stronger protection.
Core principles include lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Organizations must have a legal basis for processing, such as consent, contract, legal obligation, vital interests, public task or legitimate interests. Consent must be freely given, specific, informed and unambiguous.
2. Your rights under GDPR
People in the EU have rights to:
- Access their data and receive information about its use.
- Rectification of inaccurate data.
- Erasure, often called the right to be forgotten, in certain circumstances.
- Restriction of processing.
- Data portability, receiving data in a usable format.
- Object to processing, including for direct marketing.
- Not be subject to solely automated decisions with significant effects, with safeguards.
Organizations generally must respond within one month, with possible extension. They must also notify regulators of many breaches within 72 hours of becoming aware. Regulators can impose fines up to 20 million euros or 4 percent of worldwide annual turnover for the most serious violations. For example, Ireland’s regulator fined Meta 1.2 billion euros in 2023 over data transfers.
3. Does GDPR protect Americans?
Mostly, no. GDPR protects people in the EU and applies to organizations that target or monitor them. An American in the United States dealing with a US company is generally not covered, though a company that serves both EU and US customers may extend GDPR-style tools to everyone. Americans traveling or living in the EU may be covered while there. So GDPR is not a general shield for US residents.
What it did do is raise global expectations. Many companies built privacy tools such as data download, deletion requests and cookie controls, and several US states modeled their laws on it. Our article on privacy: digital age consequences explains the broader shift.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. How the United States differs
The US has no single comprehensive federal privacy law. Instead it has:
- Sector laws: the Fair Credit Reporting Act for credit and background reports, HIPAA for certain health entities, the Children’s Online Privacy Protection Act, the Gramm-Leach-Bliley Act for financial institutions and others.
- FTC enforcement: The Federal Trade Commission acts against unfair or deceptive practices. See ftc.gov.
- State laws: About twenty states, beginning with California, have passed comprehensive privacy statutes. Typical rights include access, correction, deletion and opt-out of sale, sharing and targeted advertising, though definitions and exemptions vary. Some require companies to honor opt-out signals such as Global Privacy Control.
- Data broker laws: California, Vermont, Texas and Oregon require brokers to register. California’s Delete Act created DROP.
5. GDPR versus US state laws: a snapshot
| Feature | GDPR | Typical US state law |
|---|---|---|
| Scope | People in the EU | Residents of the state |
| Default model | Lawful basis required | Opt-out for most uses; opt-in for sensitive data in some states |
| Right to delete | Yes, with conditions | Yes, with exceptions |
| Right to opt out of sale | Objection rights | Yes |
| Regulator | Data protection authorities | State attorney general or agency |
| Fines | Up to 4 percent of global turnover | Per-violation penalties |
6. What Americans can do in 2026
Use state rights. If you live in a state with a privacy law, submit access and deletion requests to companies. Keep records of requests and responses. Learn more in opt-out privacy benefits.
Use California DROP if you live in California. The platform at privacy.ca.gov/drop opened January 1, 2026, and registered brokers began processing requests on August 1, 2026.
Opt out of data brokers. Use official pages such as spokeo.com/optout, suppression.peopleconnect.us and thatsthem.com/optout. See the data brokers selling your personal information.
Turn on Global Privacy Control and use tracker blocking.
Ask Google and Bing to remove personal results.
Use secure submission practices when sending requests. Read secure online opt-out submission.
Protect your credit. Freeze credit at IdentityTheft.gov.
File complaints. If a company ignores a valid request, complain to your state attorney general or the FTC at reportfraud.ftc.gov.
7. If you are in the EU or deal with EU services
Use the rights directly. Contact the organization’s data protection officer or privacy contact. If you are not satisfied, complain to your national data protection authority. Many organizations provide self-service dashboards for downloading and deleting data. Keep records of your requests, and remember that exceptions exist, such as legal obligations to keep certain records.
8. Limits of GDPR
GDPR has been criticized for cookie-banner fatigue, uneven enforcement across countries and complexity for small businesses. It does not stop all tracking, and it does not erase information already published or sold elsewhere. Rights depend on individuals asking. Like US laws, it works best when combined with personal habits such as sharing less and reviewing settings.
9. A worked example
Mateo lives in Texas and uses a service with a global privacy dashboard modeled on GDPR. He downloads his data, deletes old activity and opts out of ad personalization. He then sends state-law deletion requests to two retailers, opts out of seven people-search sites and sets up GPC. A month later he receives confirmations from the retailers and sees most listings gone. He keeps a log of dates and responses.
10. Myths about GDPR
“GDPR protects everyone online.” Its scope is limited. “GDPR ended tracking.” It limited it, but tracking continues. “Fines make every company comply.” Enforcement varies. “US residents have no rights.” State laws give many.
11. GDPR’s influence on websites, apps and your daily experience
Even if GDPR does not cover you directly, you encounter its influence every day. Cookie banners that ask for consent, download-your-data buttons, deletion forms and clearer privacy notices were largely driven by GDPR compliance. Companies often roll out one global interface rather than maintaining many versions, which benefits users everywhere. Look for these tools in your accounts: a data download page, an option to delete your account and a list of the advertising partners you can opt out of. When they exist, use them. If a company lacks them, ask why, and consider whether you want to keep an account there. For general privacy guidance in the United States, see the Federal Trade Commission and our guide to understanding the importance of data privacy.
12. International transfers and why they matter
Personal data often crosses borders. GDPR restricts transfers of EU residents’ data to countries without adequate protection unless safeguards are in place, which led to the invalidation of earlier data-transfer frameworks and to new arrangements between the EU and the United States. The details change, but the principle is simple: protection should follow the data. For you, this means that where a company stores your data and which laws apply can affect your rights, and the privacy policy should explain it. If you want to know which regime applies, look for the section on international transfers and the contact for the data protection officer.
13. Practical tips for sending requests
When you send an access or deletion request, keep it clear and short. State your name and the email on the account, cite the law that applies (GDPR or your state statute), describe what you want and ask for confirmation. Use the company’s official privacy contact or form, and save a screenshot or email copy. If you do not hear back within the stated period, send a reminder and, if necessary, file a complaint with the regulator. Using a separate email address for requests helps avoid exposing your main inbox, and our guide to opt-out privacy benefits explains how to keep control of the process.
14. Three scenarios
Scenario 1: You are an American traveling in Europe. GDPR may apply to services targeted at people in the EU.
Scenario 2: You live in a state without a privacy law. Use opt-out forms, which most brokers apply nationally.
Scenario 3: A company ignores your request. Escalate to your regulator.
15. What to expect: a realistic timeline
| Action | Time to do | When it takes effect |
|---|---|---|
| Access or deletion requests | 1 to 2 hours | Within 30 to 45 days typically |
| GPC and cookie settings | 15 minutes | Immediate |
| Broker opt-outs | 2 to 4 hours | Days to 4 weeks |
| California DROP | 20 minutes | Processed on brokers’ schedule |
| Rechecks | 15 to 30 minutes | Every 60 to 90 days |
16. Common mistakes
- Assuming GDPR covers you automatically.
- Not keeping records of requests.
- Believing a law replaces personal habits.
- Overlooking data brokers.
- Missing deadlines to follow up.
17. How Wiperts helps you use your rights
Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so relisted data is removed again, handling the repetitive requests that privacy laws make possible.
See where your data is listed.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
18. Key takeaways
- GDPR is the EU’s privacy law, with strong rights and large fines, mainly for people in the EU.
- US protection comes from state and sector laws, plus FTC enforcement.
- Use state rights, DROP, GPC and broker opt-outs.
- Rights work best alongside good habits.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
19. Frequently Asked Questions
What is GDPR?
The General Data Protection Regulation is an EU law that sets rules for collecting and using personal data and gives individuals rights over their data. It took effect on May 25, 2018.
Does GDPR protect Americans?
Mainly people in the EU, and data handled by organizations subject to the law. Americans living in the US generally rely on US state and sector laws, though some companies apply GDPR-style rights widely.
What rights does GDPR give?
Access, rectification, erasure, restriction of processing, data portability, objection and protection against some automated decisions.
How big are GDPR fines?
Up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious violations.
How does the US compare?
The US has no single federal privacy law. About twenty states have comprehensive laws with rights to access, delete and opt out, plus sector laws for credit, health and children.
What can I do as an American?
Use state privacy rights, opt out of data brokers, use California DROP if eligible, apply Global Privacy Control and request deletion from companies you no longer use.
Sources
- ftc.gov
- privacy.ca.gov/drop
- spokeo.com/optout
- suppression.peopleconnect.us
- thatsthem.com/optout
- IdentityTheft.gov
- reportfraud.ftc.gov
Related Reading
- Why You Should Opt Out Instead of Opting In
- Why Data Privacy Is Important: What Most People Miss
- How Important Is Data Privacy? A Practical Answer for 2026
- The Data Brokers Selling Your Personal Information in 2026
- How to Opt Out of Pre-Approved Credit and Insurance Offers
- The Real Cost of Lost Privacy in the Digital Age
- Why Can’t We Stop Data Brokers From Selling Our Data?
- The Complete Online Privacy Protection Guide for 2026
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing